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Background 


The U.S. Department of Education’s (Department’s or ED’s) Student Privacy Policy Office (SPPO) and 
its Privacy Technical Assistance Center (PTAC) are conducting a four-year review of the websites of 
1,504 Local Education Agencies (LEAs) to identify whether and how these websites include information 
on student privacy. The review is part of ED‘s Strategic Plan Goal 3.2 to improve student privacy and 
cybersecurity. SPPO is responsible for administering the Family Educational Rights and Privacy Act 
(FERPA) and the Protection of Pupil Rights Amendment (PPRA). 


As part of improving student privacy, the study will provide an annual snapshot of LEA websites for each 
year of the study, as well as conduct a final trend analysis. The focus of the study is on LEA best 
practices and compliance in providing information on federal student privacy law and will determine 
whether changes occur over the four years of the study based on what is posted on LEA websites. 


Executive Summary 


The Student Privacy Policy Office (SPPO) is reviewing over four years a sample of the websites of 1,504 
Local Education Agencies (LEAs) to identify whether and how these websites include information on 
student privacy. In year one of the study, a review of a nationally representative sample of 376 LEA 
websites focused on whether they included key student privacy documents and information on the 
Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment 
(PPRA) on the LEA website as opposed to on individual school, board policy manual, or other websites. 


e 60% of LEAs reviewed posted on their websites the LEA’s Annual Notice under the Family 
Educational Rights and Privacy Act (FERPA), 


e 54% of LEAs posted on their websites the LEA’s policy under the directory information 
exception under FERPA, and 


e 32% of LEAs posted on their website the LEA’s policy under the Protection of Pupil Rights 
Amendment (PPRA). 


For these three key privacy documents that are posted on the LEA websites, fewer than 20% are listed 
as primary website content. In more than 50% of the cases, the documents are included as part of the 
student handbook which may be a PDF or other type of document navigated to from the LEA webpage. 
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For the websites reviewed, 13% of LEA websites have navigation menus that include a section indicating 
where to find data practices and student privacy information. Moreover, only 8% of LEA websites 
include the LEA contact information if parents have questions about data sharing and student privacy. 


Sample Selection 


In order to complete the review, a sampling plan was developed to determine the Local Education 
Agencies (LEAs) to be reviewed across four years of data collection (2019, 2020, 2021, and 2022). A 
single sample of 1,504 LEAs was selected at the outset of the study, and randomly divided across the 
four data collection years to create a nationally representative sample for each year. In addition, a 
replacement sample of 100 LEAs was selected that may be used if any of the original sample LEAs are 
not feasible to include at the time of data collection (e.g., if LEA status changes from “open” to “closed,” 
“inactive,” or “future”, or if the LEA’s website is inactive). 


In year one of the study, the nationally representative sample of 376 LEA websites was reviewed to 
evaluate usage of student data privacy transparency best practices. The sample was selected to 
represent school districts of different sizes and socio-economic status across different geographic 
regions. The LEA website review focused on identifying key privacy related documents or information 
on the LEA district website vs on the board or individual school websites. 


SPPO recommends as a transparency best practice that LEAs post their FERPA and PPRA student- 
privacy related information on their websites so that information is easily available to parents and the 
community. FERPA does not require that LEAs post on their websites their annual FERPA notice but 
specifically requires LEAs to annually provide notice to parents of students and eligible students of their 
rights under FERPA “by any means that are reasonably likely to inform the parents or eligible students of 
their rights.” See 34 CFR § 99.7. 


Results 


Although 60% of LEAs reviewed have the FERPA Annual Notice posted on the website, only 13% of LEA 
websites have navigation menus that include a section indicating where to find data practices and student 
privacy information. Moreover, 92% of LEA websites do not include contact information if parents have 
questions about data sharing and student privacy. 


Topic: Annual Notice 


e 60% of LEAs have the FERPA Annual Notice on the website. 
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Percentage of LEAs with Annual 
Notice on the Website 


60% 


40% 


Yes No 


e When the FERPA Annual Notice is on the website, 66% of the time it is the ED Model notice or 
a minor variant of that. 


e In 34% of LEAs, the FERPA Annual Notice is customized by the LEA. 


Characteristics of Custom Notice Percent Yes 


Does the custom notice include the right to inspect and review their 
education records? 


Does the custom notice include the right to seek to amend those 
records? 


Does the custom notice include the right to consent to disclosure of 
Pll from those records (unless an exception applies)? 


Does the custom notice include the right to file a complaint with the 
Department regarding an alleged FERPA violation? 


Does the custom notice include the procedure for exercising the 
right to inspect and review education records? 


Does the custom notice include the procedure for requesting 
amendment of those records? 


Does the custom notice include the district’s criteria for determining 
who constitutes a “school official”? 


Does the custom notice include the district’s criteria for determining 
what constitutes a “legitimate educational interest’? 


PTAC-IB-8, April 2020 3 


AOS o Dow <0 th : 


e = In only 20% of LEAs, the Annual Notice is posted as primary website content, meaning the 
content is visible on the LEA main website or available from a dropdown menu without going to 
a PDF or a separate external website. 


e In 56% of LEAs, the notice is included in the student handbook. In most of these cases, the 
handbook is a pdf that requires the user to search through the document to find the 
information. In 28% of LEAs, the notice is included in a document other than or in addition to 
the student handbook. 


Examples of Document Types Displaying LEA Annual 
Notices Besides Student Handbooks 


Annual Notice Regarding Student Records 


Annual notification document 


Rights and Responsibilities Guide 


Annual Parent Notice 


Parent's Guide to Student Data Privacy 


Annual Notice Regarding Student Records 


Annual notification document 
Rights and Responsibilities Guide 


e In 69% of LEAs, there is an indication of when the policy was last updated. However, in many 
cases, the date of update pertains to the entire student handbook, not the specific policy. 


Topic: Directory Information 


e 54% of LEAs have the Directory Information Policy on the website. 
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Percentage of LEAs with 
Directory Information Policy 
Posted on the Website 


54% 


Yes No 


e When the Directory Information Policy (Dl) is on the website, 50% of the time it is the ED 
Model notice or a variant of that. 


e In 50% of LEAs, the Directory Information Policy is custom. 


Characteristics of Custom DI Policy Percent Yes 


Does the custom policy include the types of PIl 
that the district or school has designated as 
directory information? 


Does the custom policy include an explanation of 
the right of parents and eligible students to 


request that the information about the student 
not be disclosed as directory information? 


Does the custom policy include a specified period 
of time within which a parent or eligible student 
may notify the school or LEA in writing that they 
do not want any or all of the information 
disclosed as directory information? 


e In 31% of LEA’s, the LEA directory information policy is a limited DI policy. A limited directory 
information policy might allow limited disclosure of directory information to third parties for 
legitimate educational purposes, while disallowing the disclosure of this same information to 
third parties for purposes such as marketing. 
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Characteristics of DI Policy Percent Yes 


Does the LEA DI include Student ID? 


Does it specify that student ID, by itself, 
cannot be used to gain access to education 
records except when used in conjunction with 
one or more factors that authenticate the 
user’s identity (e.g., password)? 


Does the LEA DI policy include photo/video 
likenesses? 


Does the LEA DI policy have a separate 
video/photo consent policy (e.g., for social 
media, newspaper, etc.)? 


Does the DI notice include disclosure to 
military recruiters? 


Is there a separate notice for disclosure to 
military recruiters? 


Does the LEA provide a "menu" approach 
allowing parents to opt in/out of specific 
disclosures? (Note details in comments.) 


e In only 20% of LEAs, Directory Information is posted as primary website content, meaning the 
content is visible on the LEA main website or available from a dropdown menu without going to 
a PDF or a separate external website. 


e In 54% of the LEAs, the notice is included in the student handbook. In most of these cases, the 
handbook is a pdf that requires the user to search through the document to find the 
information. In 30% of LEAs, the notice is included within or as part of another document. 


Examples of Document Types Displaying LEA Directory 
Information Policies Besides Student Handbooks 


Annual Notice Regarding Student Records 


Annual parent notification 


Rights and Responsibilities Guide 


Annual notices 
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Curriculum Catalog 


Student Code of Conduct 


Annual required public notices 


e In 72% of LEAs, there is an indication of when the policy was last updated. However, in many 
cases, the date of update pertains to the entire student handbook, not the specific policy. 


Topic: PPRA 


e 32% of LEA’s have the PPRA Policy on the website. 


Percentage of LEAs with PPRA Policy 
Posted on the Website 


68% 


e When the PPRA Notice is on the website, 80% of the time it is the ED Model notice or a variant 
of that. 


e In 20% of cases the PPRA Notice is custom. 


Characteristics of Custom PPRA Notice Percent Yes 


Does the LEA PPRA policy indicate it is 
provided to parents at least annually? 


Is there an indication when the LEA PPRA 
policy was last updated? 
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In only 13% of LEAs, the PPRA policy is posted as primary content, meaning the content is 
visible on the LEA main website or available from a dropdown menu without going to a PDF or 
a separate external website. 


In 57% of the LEAs, the notice is included in the student handbook. In most of these cases, the 
handbook is a pdf that requires the user to search through the document to find the 
information. In 28% of LEAs, the notice is included within or as part of another document. 


Examples of Document Types Displaying LEA PPRA Notices 
Besides Student Handbooks 


Annual Notice Regarding Protection of Student Rights 


Student Family Privacy Rights 


Code of Conduct 


Parent Notifications 


Data Governance Policy and Procedure 


Included in a FERPA resources for parents document. 


Topic: Data Inventory 


PTAC- 


Only 5% of the LEAs have a data inventory listing available on their websites. When there is a 
data inventory listing, in 33% of LEAs, data element usage is defined. In 39% of LEAs having a 
data inventory listing, data elements are clearly defined using plain and simple language. 
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Percentage of LEAs with Data 
Inventory Listing Information 
Posted on the Website 


95% 


Topic: Data Security 


e 26% of LEAs have a description of IT security and data protection policies on the website. 


Percentage of LEAs with Description of 
IT Security/Data Protection Policies 
on the Website 


74% 


26% 
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Characteristics of Data Security Policies Percent Yes 


Does the LEA website have a description of 
policy or procedures specifically for paper 
records? 


Does the LEA website have a description of 
policy or procedures specifically for digital 
information? 


Does the LEA website have a description of 
policy or procedures specifically access to 
student PIl? 


Does the LEA website have a description of 
policy or procedures specifically use of student 
PII? 


Does the LEA website describe how student 
records are retained (identifiable, 
minimized/redacted, de-identified)? 


Does the LEA website have policies describing 
how the LEA de-identified student Pll before 
published or disclosed to third parties? 


Topic: Data Sharing 


e 28% of LEAs have a description of data sharing policies posted on their websites. 


Percentage of LEAs with Data Sharing 
Policies Posted on the Website 


72% 


28% 


Yes No 
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Characteristics of Data Sharing Policies Percent Yes 


Does the LEA website indicate if student PII is 
shared with third parties? 


Does the LEA website indicate if PIl shared 
with external researchers? 


If yes, are written agreements with researchers 
available? 


If yes, are study results available? 


If yes, are any resulting changes to curriculum, 
policies, or programs listed? 


Does the LEA website indicate if Pll shared 
with ed tech companies? 


Does the LEA website indicate the purpose for 
sharing PII with ed tech companies? 


Does the LEA website have contracts or 
written agreements disclosing students’ PII 
posted online? 


Does the LEA website have a list of approved 
online services or "apps" used in classroom? 


Does the LEA website describe a policy or 
process for vetting/approving apps? 


Does the LEA website list any differentiation 
between required and optional apps? 


Are links to non-contracted apps’ terms of 
service posted? 


Topic: Communications 


e 9% of LEA websites include contact information for someone specifically if parents have 
questions about data sharing and student privacy. 
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Percentage of LEA Websites 
with Contact Information for 
Privacy Information 


91% 


Yes No 


13% of LEA websites have navigation menus that include a section indicating where to find data 


practices and student privacy information. 
84% of LEA websites have a search tool. 


Search Tool Term Results Include Privacy- 
Related Information 


FERPA 


Annual Notification 


Student Privacy 


Directory Information 


PPRA 


Technology 


Applications 


Apps 


Privacy 


Confidentiality 


Disclosure 


Security 
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e 3% of LEA websites include a glossary of privacy related terms. 


e 66% of LEA websites have language translations. 


Language Translation Percent of LEAs 


All privacy related 
documents available in 
language translations 


Key privacy related 
documents available in 
language translations 


Example documents Annual Notice, Directory Information 


included Policy, PPRA, Privacy FAQs, Student 
Handbook, Entire website is available 
in language translations, 


Example languages available | Spanish, Korean, Russian, Vietnamese, 
Arabic, Chinese, French, Tagalog, 
Italian, German, Hindi, Japanese 


(in many cases, the sites use google 
translate which provides translations 
in many languages) 


Plans for Years 2-4 Samples 


Each of the Years 2 through 4 samples will be subject to the same procedures and sampling tool to 
collect data, analyze, and share with LEAs examined. Each year will produce a high-level summary of the 
findings from that year. After each review, SPPO staff and contractors will provide outreach to the 
selected LEA. 


One hundred percent of these reviews will be completed by the end of the fifth year of the study, by 
September 30, 2022. After completion of all reviews, SPPO will produce a final report summarizing the 
findings and making general recommendations for all LEAs. 
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